Full deployment history for this project.
Merge pull request #107 from mbarbine/copilot/merge-all-pull-requests
Merge pull request #107 from mbarbine/copilot/merge-all-pull-requests Consolidate all open PR branches into a single merge-ready integration branch
Merge all open PR branches into consolidation branch Agent-Logs-Url: https://github.com/mbarbine/platphorm-cobol/sessions/99f19ad4-46b9-4c76-a020-585fde1275d6 Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🔒 [security fix] Add input validation to Jobs API
🔒 [Information Disclosure via Upstream Fetch Error] 🚨 Severity: HIGH 💡 Vulnerability: Information Disclosure via Upstream Fetch Error. Several MCP tools inside `app/api/mcp/route.ts` were invoking `fetch` without checking `!res.ok`. On failed downstream connections (like `502 Bad Gateway` returning HTML error pages from an upstream provider or internal API errors), it would directly pass HTML/text strings via `await res.text()` into the result payload. 🎯 Impact: An attacker could force an upstream error (or encounter one naturally) and read internal error details, HTML error pages, or proxy details exposed by the upstream service, leading to information disclosure. 🛠️ Fix: Added `!res.ok` checks for all fetch calls in `app/api/mcp/route.ts` to return standard, generic JSON-RPC error responses (e.g. `code: -32603`) on upstream failures. Added `console.error` calls to securely log the internal details/status on the server-side within the conditionals and global `catch` blocks before responding to the c
🛡️ Sentinel: [MEDIUM] Fix DoS risk in Kanban API by enforcing max length on taskId query param
Add length limits to Kanban API to prevent DoS
⚡ Bolt: Optimize extractDataItems regex short-circuiting Reorganized `extractDataItems` to avoid checking `DATA_DIVISION_REGEX` repeatedly on every line after the `DATA DIVISION` block has started, avoiding O(N) evaluation inside inner loops.
⚡ Bolt: Short-circuit regex evaluations in extractParagraphs and extractFileOperations Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #88 from mbarbine/palette/skip-to-content-13708786408850005898 🎨 Palette: Add skip to content link
Merge pull request #94 from mbarbine/bolt-optimize-trim-allocation-11679242444480658438 ⚡ Bolt: Optimize trim allocation in cobol-analyzer.ts
🛡️ 🧹 Security fixes and API enhancements - Implement 100KB payload size limits in analyze, modernize, ascii, and kanban routes. - Sanitize validation error responses by removing Zod format details. - Add AbortSignal timeouts to all outbound fetch calls in mcp, jobs, and kanban-client. - Update modernize endpoint to use claude-3-5-sonnet-20240620. - Update OpenAPI documentation (docs/route.ts) to reflect new security responses. - Add comprehensive unit tests in lib/api-routes.test.ts. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🛡️ 🧹 Security fixes and API enhancements - Implement 100KB payload size limits in analyze, modernize, ascii, and kanban routes. - Sanitize validation error responses by removing Zod format details. - Add AbortSignal timeouts to all outbound fetch calls in mcp, jobs, and kanban-client. - Update modernize endpoint to use claude-3-5-sonnet-20240620. - Update OpenAPI documentation (docs/route.ts) to reflect new security responses. - Add comprehensive unit tests in lib/api-routes.test.ts. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #77 from mbarbine/🧹-extract-modernize-hook-15617014032345639447 🧹 Extract handleModernize to useModernize hook
Merge pull request #86 from mbarbine/jules-365528326048694280-ff5d09d8 🧹 Refactor AnalysisPanel to extract complex JSX sub-components
Merge pull request #92 from mbarbine/performance-ascii-svg-generation-opt-15049739776636782583 ⚡ Optimize ASCII SVG generation by reducing string re-allocations
⚡ Optimize ASCII SVG generation by reducing string re-allocations - Consolidate multiple .split("\n") calls into one. - Replace chained .replace() calls with a single regex pass and lookup map. - Move ESCAPE_MAP to module scope to avoid re-allocation per request. - Preserves exact functional parity (escaping and truncation). Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
security: add .max() constraints to session schemas to prevent DoS Added length validation to string fields in SessionHistoryItemSchema and SessionDataSchema. This provides defense-in-depth against oversized payloads. Added unit tests to verify the new constraints. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🛡️ Jules here! I've addressed a medium-severity vulnerability regarding missing input validation in the Kanban API. To prevent potential Denial of Service (DoS) attacks from oversized payloads, I implemented string length constraints in the Zod schema and added explicit checks for query parameters. I have verified these changes through a thorough code review and by running the necessary unit tests. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #85 from mbarbine/test/mcp-error-handling-836283076298208166 🧪 Test MCP JSON-RPC Internal Error Handler
Merge pull request #81 from mbarbine/jules-refactor-homepage-4973653721063206151 🧹 [Refactor HomePage into smaller semantic components]
feat: Add Content-Security-Policy header to next.config.mjs Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
perf: Pre-allocate array for trimmed lines in cobol analyzer Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🔒 [security fix] Implement secure server-side logging for API errors Added console.error logging to all API route catch blocks and upstream failure points to improve observability while maintaining generic error responses for clients. Affected routes: - app/api/ascii/route.ts - app/api/analyze/route.ts - app/api/modernize/route.ts - app/api/kanban/route.ts - app/api/mcp/route.ts - app/api/jobs/route.ts Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🧪 Add unit tests for computeComplexity function in cobol-analyzer.ts - Implement comprehensive tests for all complexity tiers (trivial to enterprise). - Verify scoring logic for line counts, control flow, file I/O, risks, and dependencies. - Validate score caps and descriptive factor reporting. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Add Content-Security-Policy header to global Next.js configuration Implemented a foundational CSP policy in `next.config.mjs` to add defense-in-depth against XSS and cross-site injections. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🎨 Palette: Add skip to content link 💡 What: Added a 'Skip to content' link for keyboard users. 🎯 Why: Improves accessibility by allowing keyboard users to bypass the navigation. 📸 Before/After: Added a visually-hidden link in `layout.tsx` that appears on focus. ♿ Accessibility: Ensures WCAG compliance for keyboard navigation bypass blocks. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Add skip to main content link Adds a visually hidden skip to content link in layout.tsx that becomes visible on keyboard focus, allowing users to bypass navigation. Also adds the required `id="main-content"` target to the `<main>` element in page.tsx. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Refactor AnalysisPanel to extract complex JSX sub-components Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Add unit test for MCP API error handling fallback Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🧹 [Extract handleToolCall to reduce POST function length] Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
🧹 Extract LanguageSwitcher from TopBar to improve code health Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #73 from mbarbine/sentinel-security-headers-15181664421721662096 🛡️ Sentinel: [security improvement] apply global security headers
🛡️ Sentinel: [security improvement] apply global security headers Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Performance: short circuit regex checks inside computeMetrics. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #69 from mbarbine/bolt-optimization-16972739294323949241 ⚡ Bolt: [performance improvement] Hoist procedure division regular expressions
⚡ Bolt: [performance improvement] Hoist procedure division regular expressions Moved procedural regexes out of `computeMetrics` to global scope. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
perf: optimize Y2K regex checks in `detectRisks` with early return Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
perf: optimize Y2K regex checks in `detectRisks` with early return Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
fix(ux): add click outside handler for language dropdown Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>
Merge pull request #47 from mbarbine/palette-focus-rings-12040544371199261219 🎨 Palette: [UX] Add focus states to static navigation elements
Add files via upload
Add title for Cobol Modernization project
Merge branch 'main' into palette-fix-history-close-btn-a11y-15130137813028816306
Merge pull request #28 from mbarbine/palette-fix-history-close-btn-a11y-15130137813028816306 🎨 Palette: Improve accessibility of history panel controls
Merge pull request #30 from mbarbine/bolt-precompute-string-trim-5959791127491200822 ⚡ Bolt: [performance improvement] Optimize string trim and regex exec
Merge pull request #31 from mbarbine/palette-inline-clear-confirm-13059900541290327748 🎨 Palette: [UX improvement] Add inline confirmation to clear code button
perf: optimize regex compilation in cobol-analyzer.ts - Pre-compile 14 static regex patterns as constants to avoid recompilation in loops and functions. - Replace `.match()` with `.test()` for boolean checks to improve performance. - Measured a 23.1% performance improvement in the analysis logic. Co-authored-by: mbarbine <3211492+mbarbine@users.noreply.github.com>